diff --git a/ANTI_DRIFT.md b/ANTI_DRIFT.md
index b211944..849262c 100644
--- a/ANTI_DRIFT.md
+++ b/ANTI_DRIFT.md
@@ -56,3 +56,20 @@ The following are explicitly disallowed:
 
 All auth must flow:
 Portal → JWT → APIv2
+
+## Console Anti-Drift Rule
+
+The interactive console **MUST** remain:
+
+- PTY-backed
+- Agent-owned
+- WebSocket-based
+- Full duplex (input + output)
+
+🚫 Disallowed:
+- Log tailing as "console"
+- Exec-per-command models
+- Frontend-owned processes
+- Proxmox console passthrough
+
+Any deviation requires explicit architectural review.